Synthient Credential Stuffing Threat Data data breach: 2.0B accounts exposed
Severity: critical · Patch status: no-fix-needed · Since 2025-11-06
During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources. Comprised of email addresses and passwords from previous data breaches, these lists are used by attackers to compromise other, unrelated accounts of victims who have reused their passwords. The data also included 1.3 billion unique passwords, which are now searchable in Pwned Passwords. Working to turn breached data into awareness, Synthient partnered with HIBP to help victims of cybercrime understand their exposure. Exposed data: email addresses, passwords. The breach dates from Apr 11, 2025; Have I Been Pwned loaded it on Nov 6, 2025.
What to do
- If you had a Synthient Credential Stuffing Threat Data account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
